Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

angry tapir writes "The stolen credit card numbers of millions of Target shoppers took an international trip — to Russia. A peek inside the malicious software that infected Target's POS (point-of-sale) terminals is revealing more detail about the methods of the attackers as security researchers investigate one of the most devastating data breaches in history. Findings from two security companies show the attackers breached Target's network and stayed undetected for more than two weeks. Over two weeks, the malware collected 11GB of data from Target's POS terminals. The data was first quietly moved to another server on Target's network and then transmitted in chunks to a U.S.-based server that the attackers had hijacked. Logs from that compromised server show the data was moved again to a server based in Russia starting on Dec. 2."
A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.

Considering that the terminals in question were running un-patched, net booted XP SP2 WinPE instances with an old Java 4 version, the fact that there were attack vectors should be a long ways from shocking.

Target doesn't really care. They had $100 million in cyber security insurance so most of the cost of this will be covered. AFA the public not trusting Target, well, it will pass quickly because the masses have a short attention span.

They might care, but I can bet their solution will be more bureaucracy rather than better technology. There are likely IT people within the company that see the problems and know how to fix them but they will be ignored. CxO types hate those annoying IT people that are always complaining about security. They will bring in a solution sold by a slick sales person at a major company.

Traget outsourced IT operatations and field work is subbed out as well.

So maybe the IT people within the company that see the problems and may know how to fix them are so far apart form the people who work that team that they can't get stuff down or things are setup up that way so it's easier to sub work out vs locking stuff down and giving each Subcontractor there own logins / private email / info on the system.

Using common logins / just giving the info contractors who then giving that info out to the subcontracts is easier and makes it easier to change firms on each level. But then that info may not get changes / ends in the hands of non tech people who may not give it the security it needs.

I usually don't post comments asking people with moderator points to mod a comment up, but mod up this parent....

There are likely IT people within the company that see the problems and know how to fix them but they will be ignored. CxO types hate those annoying IT people that are always complaining about security. They will bring in a solution sold by a slick sales person at a major company.

Is likely the most accurate statement I've seen in a while. In my 20+ years in the tech/IT/OT field, what a salesman

It is also possible that their underwriters could claim that Target did not take due diligence in protecting its network and thus a full payout is not warranted. Insurance companies do not like being treated like a blank check to not take precautions.

It is also possible that their underwriters could claim that Target did not take due diligence in protecting its network and thus a full payout is not warranted. Insurance companies do not like being treated like a blank check to not take precautions.

That's not what underwriters do. Underwriters would be the ones responsible for not researching the security measures Target had in place when they estimated the premiums that should be charged.

Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.

Furthermore, it seems Target was self-insured for this. So it isn't quite correct to think they will glibly had this bill to an insurer - they ARE their own insurer.

Last I'd heard, the expected sum of lawsuits, settlements, fines, etc. would be WELL over $100mil (as in several times that). Apparently, for reference, a similar breach, TJ Maxx, ended up being closer to $200mil.

While $200 million is a lot of money to a lot of people, it's less than 10% of Target's typical annual profit. Some financial summaries [target.com]

The performance bonuses will be paid out on time and at maximum value. Employee hours will be cut and managers will make speeches about how they all have to pull together and do more with less (except the CxOs of course) to get through the tough times.

the insurance company should just fuck 'em at this point for not keeping up their part of the deal - there's certain ways of acting that was expected from target - and well, if they happen this often then they should charge them 15 million per year for the insurance at least.

oh and you know, the fucking big cc companies should just treat them the same as any smaller business, but they don't. if some mom'n'pop had similar happening they wouldn't be charging

The thing that bugs me most is that they were on a network that was routed to the entire internet. Yeah, I don't think a POS terminal needs to be able to check Google or Facebook, much less "chernyykhod.ru". Even simply putting them on a VLAN with a very restrictive firewall to the public internet would have avoided the problem. And a RFC-1918 network doesn't count if it's behind a NAT router, since these packets went outbound from the POS. Belt and suspenders.

The actual report on the software installed on the agent makes it pretty clear that the information was being gathered locally and forwarded internally to a collection point before being sent to Russia, like I suggested in previous threads:

The point of sale machines try to make a connection to \\10.116.240.31\c$\WINDOWS\twain_32 -- an obvious store-and-forward point on the network for exporting the card data otuside of Target. Hackers compromised this box, likely named ttcopscli3acs, since the credentials passed to 10.116.240.31 were ttcopscli3acs\Best1_user with a password of BackupU$r.

It also made port 80 requests to 10.116.240.31 -- the server the hackers "owned" inside of Target.

The rest of the breakdown only details the registry changes that happen when you install a service -- which was the install vector. There isn't a discussion of how the skimming/scanning/card-stealing software was distributed, but...

IT WAS OBVIOUS THEY WERE ALREADY INSIDE THE NETWORK - they (p)owned servers - so it's a reasonable guess that they just deployed the software without needing any hole on the workstations.

The twain_32 folder is one of those things that casual inspection would overlook - and obviously did.

....one obvious conclusion jumped to is that the test box for ThreatExpert might also just be called "ttcopscli3acs" but the means by which this works (fowards data to an internal box) remains the same.

While I'm tacking stuff onto this, I should also say that it doesn't appear as though ThreatExpert installed this sniffer with any sort of parameters - meaning the default behavior for this executable contained the 10.116.240.31 machine expected the c$ share and twain_32 folder to exist.

Although the "kit" form of this executable may include space for selecting a new drop-off point, or the executable they examined might just have a wrapper on it that passes shares and credentials to the real executable, it w

Welcome to the world of embedded Windows. The cost of updating all of those systems would be huge not to mention testing every system with the new OS. What I do not get is if they are running Java why are they running Windows? Why not Linux?

Many of the common Point-of-Sale hardware does not have Linux drivers.

Things like the multiple Barcode Scanners, Thermal Printers, Cash Drawers, Magcard Readers, etc. are typically only provided with Windows drivers.
Like it or not, an organization like Target *NEEDS* warranty support for when something fails, and saying "we use linux" doesn't really fly.

I wonder if Target or Walmart said to the makers of those,"We need Linux drivers" if that would change? Magcard readers should not be much of an issue since they are probably USB or serial devices. A cash drawer should be an easy interface as well. The printer and Barcode scanners are the only iffy one and for all I know the Barcode scanners are USB HID devices.

Seriously, though, this means that the perps were able to setup a relay station in Russia. I would hope that a person/organization capable of this kind of operation would have the resources/foresight to relay data through several foreign countries.

How embarrassing would it be for the Target data to have been heisted straight to young Matthew Broderick's bedroom? Even if something like that did happen, I'd expect the circulated news stories to tell tales of a massive, sophisticated, international syndicate of PhD hackers, who have now been arrested and jailed, or terminated by drone strike if they were hiding in uncooperative countries. Which story inspires more confidence in the safety of our financial systems? That is likely the story that will be told.

Any connection that doesnt need an Internet presence, or doesnt have DNS sites should cut Chinas IP address space. Less SPAM and specially less cyber attacks. Even when they are not really targeted, they have simply the bigger concentration of all of old unpatched machines, and their mentally of if it works dont touch it, instead of more consumerist views of USA, it is slow, lets bin it and buy a new one, doesnt help too into being a hive of zombie machines.

Most IDS systems should trigger alerts and close the route when sending massive amounts of data ANYWHERE !

All my gear is set up that if your sending a pack over 5 megs and you didn't get auth from secops and the mac cleared the route is shut down. Yes it's draconian but it prevents a lot of network abuse and has left me with 2 300 meg circuits instead of 2 gig circuits.

Of course, this is a metaphor, saying they moved the data in a manner not to be detected, although I suspect that is not quite accurate. Most likely they did make a lot of noise while moving the data, but no one listened.

If the attackers had left a script behind to effectively re-partition or even reformat the compromised servers' hard-drives.

But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?

But what troubles me the most is the common American citizen's perception that we (as Americans), lie at the epitome of technology that works; after all, we have the "biggest and greatest" technology companies, right?

Who are some of these common American citizens? The figment of someone's imagination.

I get what your saying but you have the Chinese also "attacking" the US for secrets. I guess the tragic comedy in this, is this quote.

""A related article at Wired points out that Target suffered a similar breach in 2005, and apparently didn't learn its lesson.""

It appears nether the government or companies learn there lessons, government for being pathetically stupid enough to run infrastructure, and classified information onto open networks. Instead of closed loops...

I keep asking myself why the NSA isn't more involved in large-scale financial fraud considering their ample abilities to sample international data networks and their likely considerable focus on Russia and the involvement of shady financial transactions in funding terrorism.

In the case of Russia specifically, I would expect the NSA to be heavily involved in monitoring Russian hackers given the shadowy nexus of hackers, organized crime, ex-KGB agents, and the current FSB.

The only thing I would add is; I've never thought the NSA and agencies like them are interested in the Security of the USA for the people of the USA -- that's just the PR cover story.

The NSA needs all that data, and the CIA needs Facebook, and the TSA has to know everything about Joe Worker but totally ignores who gets on a Leer jet because this is all about the USA Police State. We are clearly on the path from a First Tier Developed Nation to a 2nd Tier and controlling

I'm wondering who costs American taxpayers more, actually - NSA or Russian hackers.
It's probably all about money - involving NSA in such operations would be a net loss regardless of the result. I'm too lazy now to check the numbers, so it's just a guess.

Target suffered similar data theft in 2005, and now again in 2013. By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant. If this happened to any other retailer, Visa would revoke their PCI compliance status. If nothing happens regarding their PCI compliance status, what does it say about PCI compliance in general? PCI compliance is nothing but a joke, not to be taken seriously. Why even go through the work and trouble to get PCI DSS certified if companies like Target can flout the rules and get away without any penalties.

Most of us aren't big enough to tell the CC companies to go fuck themselves, and customers kind of require CC processing for online purchases. Many people have learned to stay the fuck away from things like paypal by this point. A business that can't take credit cards is a business about to cease to exist, or shouldn't really be called a business in the first place.

By storing cardholder information, CVV's and (worst) PIN's in the clear, they obviously are not PCI DSS compliant

If reports are to believed, the malicious programs grabbed the information from memory on the infected POS machines. This wasn't a database that was dumped that had all the information in nice organized columns all in the clear.

While PCI compliance does call for not storing, encrypting, and/or otherwise taking certain precautions with certain data, I don't believe end to end encryption between th

Having had to write code to talk to PIN pads back in the late '90s, they still should never have had the unencrypted PINs, even with access to memory in a POS terminal. The PIN pad should be epoxy potted, with have the encryption key (and maybe even its entire firmware) injected into battery-backed RAM. The only thing leaving that PIN pad should be an encrypted blob based on the PIN. I even vaguely recall having to provide the card number to the PIN pad, making it a sort of salt to the encryption process. A

Yeah, but it's layered on top of several other free credit monitoring services I apparently have now from breakins at various companies. I'll never have to pay for credit monitoring ever. As usual Target didn't tell me WHO is doing the monitoring, or how they might contact me if something suspicious happens in my name. I expect this to be just as useful as all of the other credit monitoring services I apparently have.

Be wary of calls or email scams that may appear to offer protection but are really trying to get personal information from you. Please navigate directly to websites rather than clicking on links within emails.

Straight from an email that appeared to offer protection and asked for personal information. At least the link showed the URL in plain text so you could copy/paste or retype it easily.

So what happens is the logs are kept in the machines as well as shipped to a log server.. Depends on how they went about this.... but everything should be logging to multiple places for just this reason, hackers have automated log scrubbers that they can hide as a binary like say cd. the cd bin will get executed, but after the hook runs and scrubs the logs.

OK, so there's a lot of talk about this situation at Target. At least that one is discovered and allegedly fixed. Do these pranksters only target one store chain? Was this the easiest one to get into, and they are happy with that for now? Or are other stores similarly compromised, but either have not gone public, or do not know it yet?

They usually target more then 1 chain, but have to taylor it to each chain as the pci-dss standard is enacted differently in each chain. Usually they will breach a big chain and use the same method for others but taylor the way they do it a bit differently and most times this helps them avoid early detection. Often the breach is discovered later, much later because it was not using the same carbon copy methods that were used in another breach.

Target's security is especially lax, but part of the problem here is the POS terminals that are apparently stuck running old unpatched versions of Java. That's an industry wide problem. You can limit the exposure with proper network security, but it means if anybody does breach your security they will have no trouble escalating that into full blown card disclosure.

I'm not going to defend Target for being embarrassingly sloppy, however, no matter how you look at it, it largely doesn't matter:

a) It's a business decision to invest in cyber-insurance or cyber-security, they picked insurance. As technical people, we like technical solutions, but maybe insurance was the right choice.

b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.

c) Everyone gets credit monitoring. If the credit monitoring is not snake oil, then it'll catch cc fraud that's not a direct result of this Target screw up. This may actually be a benefit. People who were dimly aware of how the cc system works will become informed. This is probably a net positive here.

d) Awareness is raised about POS security; other companies who are running the similarly secured systems may be motivated to fix it. Another net positive.

The only people getting screwed are Target (for operating a shit system) and/or the cc issuers (for permitting Target to run a shit system).

The company that issues the card is nota always the same company that handles the payment at the store (or via Internet)

e.g. In Belgium the machines in the stores are most likely from AtosWorline, but the card can, but must not be from them. e.g. I have a card from Beobank and they are the card issuer who work under license of Visa and Mastercard. They would take the loss.

b) If a consumer gets hit by a fraudulent cc charge, they don't eat the charge. They call their cc issuer and the issuer eats the charge. That is in part what your double digit interest rate is paying for.

Fraudulent credit card charges are paid for by the merchant who sold the goods to the fraudster. When you contest a charge, the credit card issuer does a chargeback and reverses the charges on the merchant who made that transaction. The merchant then has to try to prove the charge is legit (e.g. produce a signed receipt whose signature matches the cardholder's), or he is out both the merchandise and the money. The issuer pays nothing for fraud, except for small transactions where they may decide to credit the cardholder without reversing the charges on the merchant (the charge is deemed too small and not worth the expense of investigating).

Your double-digit interest rate pays for other credit card holders who default on their bills. And to line the pockets of the credit card issuer.

Debit cardholders suffer, due to fewer protections legislated for cardholders. Credit cardholders do suffer lost time to clean up, or lost income if they get stuck with charges they either don't notice or are unable to clear. While apocryphal: my having a card stolen and abused ate about a day of my time, plus days of additional little inconveniences. Competitors get stuck with costs for compliance that Target dodged, which is anticompetitive.

That's not how fraud works, economically. You've just described a number of costs, borne by various parties in a fairly-competitive economic market place, including "that's what your double digit interest rate is paying for." And the conclude that "the consumer doesn't eat the fraud."

Economic losses from fraud are first borne by the directly-impacted party, and then those economic losses are passed around the economy according to various factors like pricing power and elasticities of supply and demand.

You're right, the cost of fraud is spread out thinly over a variety of things, and yes, we're a bit less well off than we would be in a fraud-free scenario. It's very much like insurance, although less explicitly spelled out. A loss due to shady criminals, or a loss due to lightning strike, it's still a loss.

I got the email notice from Target at TWO of my email accounts that my information had been stolen.

I pored over my financial data and found that I have not used any credit card at a Target store since 2008. So, obviously the breadth and depth of this attack are a lot more extensive than what they are telling us.

Either that or Target is simply blasting everyone in their email database whether or not they believe the customer's information was stolen, which says that Target still really has no idea whose info

I read an article on this recently, it appears that Target contacted both those whose name/address/email had been compromised AND those who use their credit card there during the time period using the same email. They should have split the two.

So it's likely that your personal information was compromised, but not your credit card number. Be on the lookout for phishing attempts.

It's funny, because at first I thought their email was a phishing attempt, because it did not come from target.com directly, and linked me to a website that had target logos and such but was also not a target.com domain. I had to make a phone call to find that it was legitimate.

You think this matters? We should have real concerns. In late October Resers had a listeria recall [fda.gov] on a lot of products produced at one assembly plant for lots of sub-companies. There has been no followup in the news (post november) detailing any further testing by them or the FDA. That original recall was initiated due to testing done in Canada. Should there be any consumer confidence by the American public that we can trust a factory like this to produce safe food? Look at their recall window on those pro

I received an email last Dec about the breach and another one yesterday offering the free credit monitoring. So I called Target and asked when my new card with new numbers was coming. Turns out -- it wasn't. Customers have to specifically call and ask for new cards to be sent. WTF?!?! A simple solution to nip this in the bud -- issue new cards with new numbers -- and they aren't doing it? I guess they would rather eat the bogus charges. If I had any Target stock, I would dump it ASAP.

Everybody knows, I would hope, that best practice is to never allow an Internet-facing server to initiate outbound traffic. This is both because, should the server get compromised, it becomes a new attack vector - as in Code Red or SQL Slammer. This is also because, as in Target's case, it makes it fairly trivial to exfiltrate stolen data.

But services still persist that require that this very access be enabled. My current case in point: ReCAPTCHA. Google hosts the URL for this service, intended to provide additional security, on a www.google.com URL, which means that, at minimum, I have to allow outbound access from any server hosting a ReCAPTCHA on port 443 to everything Google owns. In practice, of course, it's all but impossible to keep track of Google's address space for firewall purposes, so this means that I have to allow that server out on port 443 to the entire Internet. It's either that, or set up a proxy solution that can do URL filtering and then require the CAPTCHA verification code to use that. Not exactly something your typical smaller company using ReCAPTCHA is apt to do.

I've talked to competing, for-pay, services, and they require the same thing, despite the fact that they're smaller and have only a few, well-defined networks, but they won't commit to keeping me up-to-date with network changes.

We really need to start pushing back on this crap. Servers accepting inbound traffic should never need to initiate outbound communications.

Unless I'm reading it wrong you're basically disabling webservices like making a SOAP call to a third party on behalf of the connecting user-agent. That's a non-starter for just about all companies that have at least one business partner.

I'm tired of those who pretend to want to help us by giving a false link by clicking on the grounds that we can watch the film for free,
but in the end we are exposed to computer viruses, if you want to watch this film I suggest to you free of charge for saw this film in
http://goo.gl/Yde2KF [goo.gl]
there you can watch it free or you can download it, hopefully the information I provide will help you

The only problem here is that the credit card industry will then figure out yet another way to screw the small merchant. PCI compliance is a great idea. The various "insurance policies" and "penalty fees for PCI noncompliance" pushed by the interchange companies are a rip off and farce. They aren't going after my small business......but I'll pay more money to someone because some Russians hacked Target. Thanks !!!
By the way, why do we have interchange companies anyway ???

the reason is that they have outsourced their IT to India. So, now, you have 200 IT making $10K/year, who are not very well educated, and are not strong coders. They work for a company that employs ~250 ppl who have NO loyalty to a foreign company. After all, they have NO shops in India. Along comes somebody from Russia or China and offers just 1 person $100-200K to release a virus on the network. That money will set that person's extend family up for 5-10 years. And if that coder uses it just for his/her i